MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 66fb40a5ca213c6ea3377dc16e9e4e25ccd412a1b5da20399c7180d714bc10b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 6
| SHA256 hash: | 66fb40a5ca213c6ea3377dc16e9e4e25ccd412a1b5da20399c7180d714bc10b0 |
|---|---|
| SHA3-384 hash: | d0b0b179008fb44335af7ddb6254621baf31533b9d3beb376153934ead68da2442815a11d5e6ce03e1372101c69953e8 |
| SHA1 hash: | 2ee646aac77fef3187e80fddc93b6af4c3c6a4e4 |
| MD5 hash: | 4bbfe74e3b117983e8313afe305c4fee |
| humanhash: | september-princess-texas-potato |
| File name: | 8590473102_G022020000000686.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 894'976 bytes |
| First seen: | 2020-08-18 19:25:38 UTC |
| Last seen: | 2020-08-18 20:12:09 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 24576:t7E4kQYvHadvLwyZJ7NVIb8Drn2j++Aja:JE4fYvaBLNni8Hndxj |
| Threatray | 526 similar samples on MalwareBazaar |
| TLSH | 031522587624B16FD8BE8D7A96984C3043B0727B930BF2475C1394EA6F0CBE75F129A1 |
| Reporter |  abuse_ch |
| Tags: | exe geo MassLogger TUR |
abuse_ch
Malspam distributing unidentified malware:HELO: teb.com.tr
Sending IP: 156.96.47.16
From: hasan.huseyin.isik@teb.com.tr
Reply-To: ''hasan.huseyin.isik@teb.com.tr'' <chris.b2020@yaho.com>
Subject: Faks e mail talimat hakkında
Attachment: 8590473102_G022020000000686.r00 (contains "8590473102_G022020000000686.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Running batch commands
Launching a process
Deleting of the original file
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-08-18 19:27:08 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 516 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
ransomware stealer spyware family:masslogger
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.